Tag Info

Hot answers tagged

29

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


13

These are academic distinctions. In the real world, you will find some combination of all of these concepts going by different terms. In some organizations, a DMZ has a separate ISP network connection and has no access to internal resources. In other organizations, there are domain-joined machines in the DMZ that can communicate to a restricted set of ...


8

Any network segment that you don't fully control can be considered as a public network, so if you would encrypt traffic over a regular public network, do it for your case as well. NB: With full control I mean that you have full and sole control over any network devices that are part of the connection, so a port on e.g. a router or switch you don't own ...


8

As @ChristopherPerrin said, it's the background noise of the internet. Scripts and bots are constantly scanning the internet, doing the equivalent of jiggling door handles looking for ones that are unlocked or poorly locked. I do however disagree that there is nothing you can do about it. Use those logs to block them at the firewall level. On linux I use ...


8

How would this be setup connection wise without forcing all traffic through the domain controller? With site to site VPNs. You'd set up your cloud assets as a site, and then establish a site-to-site VPN between your cloud site and each of your physical sites. An alternate option, that Microsoft uses, but is generally ill-advised (unless you really, ...


7

Depends on what you're comfortable doing; when starting to "professionalize" our office network for a similarly sized business, I set up a pfSense Firewall behind our modem, and assigned it routing tasks for the office. All you need is a machine to dedicate with a few NICs and you're on your way. It's pretty well documented online, and I haven't had an ...


7

I don't think I've recently heard of an extranet outside of textbooks and class rooms. A DMZ is a common networking topology with a network segment that is segregated by firewalls from the internal network and untrusted external networks (aka the internet). In contrast the Extranet, if it is actually included in the network design, implies somewhat that ...


5

According to Technet http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx later queries are done to multiple DNS servers in parallel. And most people have only one network connection and a fast broadband connection and should normally expect a DNS response within 1s. So I have set my DNSQueryTimeouts to 1 1 1 10 10 0 so ...


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


5

I think it's actually more debated than you make it appear. There is an admittedly old, related Linux FAQ: http://www.tldp.org/HOWTO/VPN-HOWTO/ I've used a PPP-over-ssh-over-ADSL for more than 12 years, and it never failed me, so from my experience I'd dare to say that the doomsayers probably largely exaggerate. TCP over TCP is probably a bad idea with RTC ...


5

Reverse DNS points an IP to a domain name. An ISP/Hosting company should own the IP range, and it should be no problem at all for them to create a reverse DNS entry for your IP, unless it's not just your IP (you're on shared hosting). Should that be the case, you are not going to get anywhere. Your ISP/Hosting probably can get you your own individual IP, ...


4

What you don't want is a VPN. What you do want is indeed IPsec, but not in tunnel mode. Rather, you want IPsec in transport mode. In this configuration, each host communicates directly to its peer, and only packet payloads are encrypted, leaving IP headers in place. This way, you don't need to do any routing gymnastics to get things working. Yes, you'll ...


4

Setting up a VPN can be pretty easy, many routers have some built-in VPN functionality already. VPN is a broad topic and we don't know what your needs and constraints are, because you didn't tell us. You should probably hire a consultant to help you get it set up and find out what your needs and constraints are; this shouldn't be a service that you pay for ...


4

Network browsing across VPNs has always been problematic in my experience. If I were you I'd use a WINS server to get browsing to work (in an even remotely reliable manner). Other methods may well work, but deploying WINS is pretty straightforward and easy and, in my experience, has done the job.


4

With a Cisco AnyConnect VPN there is an option on the client side to allow this IF the VPN admin is allowing split-tunneling. You can see the option here: As far as on the firewall itself, if you are the VPN/firewall admin (I'm guessing you aren't) then the setting is similar to this here:


4

How can I find out what DNS server those customers are using ? Contact Chinanet and ask? Seriously, DNS is configurable on the client side. Most people get DNS settings via DHCP, but OpenDNS and Google's DNS offering wouldn't have a business model if you couldn't change them. Is there anyway to determine if an HTTP request is coming from a VPN ? ...


4

I've heard the great firewall used to redirect "blocked" traffic to a handful of phony IPs, but this was causing their blocks to be easily spotted (I'm not sure if it allowed easy subversion). In any case the administrators have started redirecting to random IPs. This has led to some Chinese users getting porn, instead of facebook or vpns, apparently. I ...


4

yes you can do this with bind views: http://www.zytrax.com/books/dns/ch7/view.html basically, you define each view as a subnet, and then each view maintains its own zone file. depending on the source ip/subnet of the dns query, you will get a different "view". this is common for name servers to use in an "internal"/"external" views, so as dns ...


3

You could use OpenVPN. If you use a OpenVPN server listening on port 443, it will probably not be filtered. However, people analyzing your network traffic will know that you are using OpenvPN: you might want to avoid this. If you want to avoid this, you could connect to the OpenVPN server through a HTTPS proxy. OpenVPN knows how to use a HTTP proxy but not ...


3

Despite being an old question I stumbled here and I can see a lot of speculation here. The other answers are likely correct to some extent, but I believe it misses the crucial factor for the situation experienced by the asker. VPN uses compression. I'm using LZO-compression and that will improve my speeds up to 4x compared to the connection width. This is ...


3

It sounds like the printer isn't configured with a default gateway. In that scenario your ping requests from "Network A" will travel to "Network B" to the printer. The printer, having no default gateway configured, won't be able to respond back to "Network B" because, without a default gateway configured, it has no ability to send packets to subnets other ...


3

What about putting it in bridged mode, and using your own router to see if the problem still happens. My guess some kind of problem in the routing side of things, persistent NAT? Anyway, just about no one that I know uses carrier provided gear, mainly for security and manageability concerns. Even if you get something else, you should consider something ...


3

In the SSLVPN adapter, in TCP/IP properties, DNS, make sure Register this connection's addresses in DNS actually checked. Often on a VPN connection it isn't...


3

Your clients are not registering their IP addresses with DNS for the simple reason that they're not configure to, when connecting to the VPN. This behavior is called Dynamic DNS Registration, and in Windows, is a per-network adapter setting. Through the GUI, you'd enable or disable this on the network adapter Properties, the Networking tab, TCP/IP ...


3

10.8.2.12 sees 10.8.2.254 as being on the same subnet, therefore it's requesting the MAC address of 10.8.2.254 to insert it as a dest MAC in future packets to 10.8.2.254. Since 10.8.2.254 doesn't exist, no one is replying and 10.8.2.12 never finds out what MAC to set as the dest MAC. Try using proxy_arp on your main server. echo 1 > ...


3

I think using a cloud service (Box, others) makes a lot of sense for your requirements, especially "minimal maintenance," , and "multiple locations." $15/user/month for Box, with some nice (AD integration, version history, central admin) features.


3

Your VPS does not support iptables, you will have to get your host to enable it for you. Alternatively get a VPS based on KVM or similar rather than containers like OpenVZ.


3

It is normal that unknown users try to connect with standard usernames. You can view it as the noise of the internet. If you have strong passwords there is no need to worry. Take it as it is and keep your software updated. There is about nothing you can do.


3

Cisco ASA firewalls all support SSL VPN. Depending on the edition and version of the firewall (Cisco ASA 5505, 5510, 5520, etc.), there's a limit to the number of simultaneous SSL VPN users that can connect. Please see this Cisco licensing reference guide. Please find out which version of Cisco ASA firewall you have. RAM for Cisco firewalls is ...


3

update your azure powershell installation. its a new cmdlet.



Only top voted, non community-wiki answers of a minimum length are eligible